TMEF Deny List Transaction Events
|
TMEF Key
|
Description
|
Value
|
|
Header (logVer)
|
TMEF format version
|
CEF: 0
|
|
Header (vendor)
|
Appliance vendor
|
Trend Micro
|
|
Header (pname)
|
Appliance product
|
Deep Discovery Inspector
|
|
Header (pver)
|
Appliance version
|
Example: 3.8.1181
|
|
Header (eventid)
|
Signature ID
|
200120
|
|
Header (eventName)
|
Event Name
|
DENYLIST_CHANGE
|
|
Header (severity)
|
Severity
|
3 (fixed value)
|
|
act
|
The action in the event
|
Add or Remove
|
|
cs1
|
Deny List type
|
|
|
cs1Label
|
Deny List type
|
type |
|
deviceExternalRiskType
|
Risk level
|
|
|
deviceGUID
|
Appliance GUID
|
Example: 6B593E17AFB7-40FBBB28-A4CE-0462-A536
|
|
deviceMacAddress
|
Appliance MAC address
|
Example: 00:0C:29:6E:CB:F9
|
|
dhost
|
Destination host name
|
Example: insta-find.com
|
|
dpt
|
Remote port
|
Value between 0 and 65535
|
|
dst
|
Remote IP
|
Example: 10.1.144.199
|
|
dvc
|
Appliance IP address
|
Example: 10.1.144.199
|
|
dvchost
|
Appliance host name
|
Example: localhost
|
|
end
|
Report end time
|
Example: Mar 09 2015 17:05:21 GMT+08:00
|
|
fileHash
|
File SHA1
|
Example: 1EDD5B38DE4729545767088C5CAB395E4197C8F3
|
|
pComp
|
Detection source
|
Sandbox
|
|
request
|
URL
|
Example: _http://1.2.3.4/query?term=value
|
|
rt
|
Analysis time
|
Example: Mar 09 2015 17:05:21 GMT+08:00
|
Log sample:
CEF:0|Trend Micro|Deep Discovery Inspector|3.8.1181|200120|D ENYLIST_CHANGE|3|rt=Mar 11 2015 07:15:45 GMT-04:00 pComp=San dbox dvc=10.201.156.143 dvchost=ddi38-143 deviceMacAddress=0 0:0C:29:A6:53:0C deviceGUID=D2C1D6D20FF8-4FC98F92-25EB-D7DA- AF0E cs1Label=type cs1=Deny List URL end=Apr 10 2015 07:15:3 5 GMT-04:00 act=Add request=http://zalepivmordu.ru:80/ devic eExternalRiskType=Medium